Generative AI has collapsed the cost and skill once required to run a convincing social-engineering campaign. A usable voice clone can now be built from a short clip of public audio—a webinar, a voicemail greeting, a conference recording—and a large language model can scrape and correlate a target's org chart, vendors, and recent projects in minutes, so the message or the caller’s plausibility is supported by accurate details and a plausible story.
The result is that attacks have become, more than ever, a numbers game. Because AI removes both the effort and the telltale errors, attackers can generate near-flawless lures and fire them at everyone, cheaply and continuously, knowing they only need one to land. The scale is already measurable. In the FBI's 2025 Internet Crime Report—the first to track AI as its own fraud category—victims filed 22,364 AI-related complaints totaling roughly $893 million in losses, a number the bureau notes almost certainly undercounts the problem because most victims never realize AI was involved. Verizon's 2026 Data Breach Investigations Report—a long-running analysis of tens of thousands of real-world breaches—reaches a complementary conclusion, describing AI-driven speed as a defining new challenge and AI's role as expanding across the threat landscape. The same lure that once took real effort and skill can now be produced perfectly, in volume, and aimed at everyone—including the voice-cloned executive approving a fraudulent wire transfer and the flawless email that slips past the grammar-and-typo instincts staff were trained to rely on.
For an MSP, that changes what "defense" means. You cannot train a technician to detect, by ear or by eye, a lure engineered specifically to be undetectable—and you cannot expect a client's staff to catch every one when the volume is effectively unlimited. The durable move is to stop relying on what a message or caller knows or sounds like and start relying on what someone can cryptographically prove they possess—shifting trust down to the identity layer.
This post is a practical guide to doing exactly that with Okta, delivered through ZeroTek: the controls to set up and configure so this AI-accelerated wave of attacks has a much harder time landing—starting inside your own business and extending to the clients you serve. (A follow-up post covers the other half of the picture—the guidance you can give clients on using AI safely themselves.)
Why MSPs are a high-value target
This shift isn't only something to protect clients from; it puts a target on your own back. An MSP holds privileged, standing access to many client environments at once, and your help desk can reset a password or authenticator, or unlock an account. That makes your service desk a concentrated chokepoint: fool one technician into "helping" an impersonated user, and an attacker can inherit the keys to a sensitive app, multiple systems, or a client's entire Okta org—or to several clients at once.
It's a well-worn pattern. Attackers don't break the cryptography; they call the help desk, sound urgent and credible, and ask a human to make an exception—and AI has made that call both more convincing and endlessly repeatable. The controls we discuss below are ones to turn on in your own tenant first, both because you're a prime target and because running them yourself is how you learn to deploy them well for clients.
Let’s be clear about what these controls are and aren’t. With one exception, they aren't "AI security" in the sense of software that inspects or blocks AI; they're identity fundamentals that help address the prevention, verification, detection, and response elements of any serious defense. What’s changed with AI is the threat around them—because AI hasn't so much invented new attacks as made the familiar ones cheaper, faster, and far more convincing. That’s why we believe that getting these fundamentals right matters more than ever. The exception is Verify Caller Identity, which meets a specifically AI-enabled technique head-on—the cloned voice on the phone. All four are available to MSPs through ZeroTek.
1. Phishing-resistant MFA and Okta FastPass – close the front door
Most credential attacks still start with phishing, and AI has stripped away the typos and awkward grammar that used to give them away. Traditional MFA—especially SMS codes and simple push approvals—doesn't hold up: codes get relayed through fake login pages, and "push fatigue" wears users down until they tap Approve.session
Okta FastPass is passwordless and phishing-resistant by design. Authentication is bound to a specific enrolled device and validated against that device's health at every sign-in, so a credential phished on a lookalike site is useless to an attacker who doesn't hold the device. There's no code to relay and no prompt to fatigue. Standardizing your own administrators and technicians on FastPass is one of the highest-leverage moves you can make—before you start deploying it across clients.
2. ZeroTek/Okta Verify Caller Identity – close the help-desk gap
FastPass protects the login. But you need something else for when a "user" calls your service desk asking for a reset. That's the gap that ZeroTek’s Verify Caller Identity feature was built to close.
Instead of falling back on knowledge-based questions—which an attacker armed with LinkedIn and a data broker can often answer—your technician triggers an Okta Verify push to the user's registered device. That's a possession-based challenge: the real user taps to confirm, and your tech sees a clear pass/fail result in real time, proceeding only on success. Because it's purpose-built for MSPs, it fits multi-tenant, standardized service-desk workflows rather than fighting them.
Two Fail-Safe options in ZeroTek make this step enforceable. Admins can require verification before any security-sensitive action—a password or authenticator reset, for example—and can require a ticket ID before proceeding, linking the work back to your PSA. Every check is captured in ZeroTek's audit logs: who ran it, when, where, and the outcome. That's due-diligence evidence you can produce in an audit and use to review technician behavior across every client.
Verify Caller Identity is deliberately narrow—it hardens one interaction rather than the whole attack surface—but it's a high-value interaction that attackers target specifically, and it's cheap insurance against a very expensive mistake.
(Note you can also verify a user’s identity via Okta Verify push challenge from the Okta Admin Console; ZeroTek allows MSP help desk staff to verify the caller from within the multi-tenant dashboard faster, in fewer clicks, without having to access the Okta Admin Console directly.)
3. Identity Threat Protection (ITP) – because risk doesn't stop at login
Authentication is a moment; a session is a window. An account can pass every check at sign-in and become dangerous ten minutes later. Okta Identity Threat Protection (ITP) extends protection into the active session: it continuously evaluates risk using signals and behavioral analysis, and it can act automatically when that risk changes.
The scenarios ZeroTek highlights are the ones MSPs see everyday. A user signs in from the U.S., then a second login attempt lands from Europe fifteen minutes later—ITP flags the impossible travel and blocks access pending verification. A phished credential produces abnormal session behavior—ITP detects it and triggers an adaptive response. Through SSF/CAEP signal sharing, ITP can even propagate security events to apps that support the standard, so risk detected in one place triggers protective actions elsewhere. ZeroTek offers Okta ITP exclusively to MSPs as a month-to-month, consumption-based add-on.
4. Universal Logout – respond in seconds, not hours
Detection only matters if you can act on it fast. Universal Logout ends a user's active sessions and revokes their tokens across Okta itself and the integrated apps that support the standard. Eligible third-party apps include Microsoft 365, Slack, and Zoom, alongside many more SAML and OIDC apps that meet the requirements. Instead of chasing a compromised session app by app, you close the door in a single action. (A quick technical note: each app must be configured for Universal Logout first, and the exact capabilities are app-specific.)
It’s important to understand what you can do today versus what capabilities require an upgrade. The ability to invoke Universal Logout manually—an admin clearing a user's sessions and revoking their tokens from the Okta console—comes with the AMFA capabilities built into ZeroTek's Okta Pro license. Most partners and their clients, in other words, already have it, and can write it into an incident-response runbook right now: the moment a compromise is suspected, a technician signs that user out everywhere at once.
What manual logout can't do is act on its own. The automated, policy-driven version—where risk is detected mid-session and the logout fires in real time, with no human in the loop—is the fuller capability, and it requires the ITP add-on. That's the difference between a technician noticing and reacting, and the system containing the threat the instant risk crosses a threshold. For clients where minutes matter, that automation is the upgrade conversation to have.
Layer them: prevent, verify, detect, respond
None of these controls is a silver bullet, and that's the point. FastPass prevents credential phishing at the login. Verify Caller Identity verifies the human before your help desk acts. ITP detects risk that emerges mid-session. Universal Logout lets you respond in seconds. Together they replace fragile human judgment with an identity fabric that assumes attacks will look and sound legitimate—because in 2026, they do.
The practical starting point for MSPs running Okta through ZeroTek doesn’t cost anything extra, and it starts at home: standardize your own team on FastPass, turn on Verify Caller Identity with its Fail-Safes, and write manual Universal Logout into your runbook—all within capabilities you already license through ZeroTek. Prove the setup in your own tenant, then roll it out to clients, adding ITP for the ones whose risk profile justifies continuous, automated protection.
ITP and other Okta add-ons that strengthen this stack are available to MSPs on month-to-month licensing with consumption-based billing, exclusively through ZeroTek—so you can match each control to each client without committing anyone to an annual contract. And once this defensive foundation is in place, the next question is how to help clients use AI safely rather than fall victim to it—which is where the next post picks up.
To talk through which controls fit your business and which fit each client, contact the ZeroTek team: success@zerotek.com